all: build with Go 1.27

Bump every remaining toolchain reference: images, goreleaser, the hi
runner fallback and docs.

.goreleaser.yml

@@ -2,7 +2,7 @@
 version: 2
 before:
   hooks:
-    - go mod tidy -compat=1.26
+    - go mod tidy -compat=1.27
     - go mod vendor
 
 release:

AGENTS.md

@@ -66,7 +66,7 @@ similar lines of code is better than a premature abstraction.
 ## Quick Start
 
 ```bash
-# Enter the nix dev shell (Go 1.26.1, buf, golangci-lint, prek)
+# Enter the nix dev shell (Go 1.27.0, buf, golangci-lint, prek)
 nix develop
 
 # Full development workflow: fmt + lint + test + build
@@ -89,7 +89,7 @@ go run ./cmd/hi doctor
 go run ./cmd/hi run "TestName"
 ```
 
-Go 1.26.1 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain
+Go 1.27.0 minimum (per `go.mod:3`). `nix develop` pins the exact toolchain
 used in CI.
 
 ## Pre-Commit with prek

CHANGELOG.md

@@ -44,6 +44,7 @@ keys remain all-access.
 
 - Expiring or deleting a non-existent pre-auth key now returns an error instead of silently succeeding [#3324](https://github.com/juanfont/headscale/pull/3324)
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
+- Headscale now requires Go 1.27 to build
 
 ## 0.29.3 (2026-07-29)
 

Dockerfile.derper

@@ -1,6 +1,6 @@
 # For testing purposes only
 
-FROM golang:1.26.5-alpine AS build-env
+FROM golang:1.27.0-alpine AS build-env
 
 WORKDIR /go/src
 

Dockerfile.integration

@@ -2,7 +2,7 @@
 # and are in no way endorsed by Headscale's maintainers as an
 # official nor supported release or distribution.
 
-FROM docker.io/golang:1.26.5-trixie AS builder
+FROM docker.io/golang:1.27.0-trixie AS builder
 ARG VERSION=dev
 ENV GOPATH /go
 WORKDIR /go/src/headscale

Dockerfile.tailscale-HEAD

@@ -4,7 +4,7 @@
 # This Dockerfile is more or less lifted from tailscale/tailscale
 # to ensure a similar build process when testing the HEAD of tailscale.
 
-FROM golang:1.26.5-alpine AS build-env
+FROM golang:1.27.0-alpine AS build-env
 
 WORKDIR /go/src
 

Dockerfile.wasmclient

@@ -7,7 +7,7 @@
 # to drive a real browser-style WebSocket GET against headscale's /ts2021,
 # guarding the regression in issue #3357.
 
-FROM golang:1.26.5-alpine AS build
+FROM golang:1.27.0-alpine AS build
 
 WORKDIR /src
 

cmd/hi/README.md

@@ -55,7 +55,7 @@ changing.
 | `--timeout`         | `120m`         | Total test timeout. Use the built-in flag — never wrap with bash `timeout`. |
 | `--postgres`        | `false`        | Use PostgreSQL instead of SQLite                                            |
 | `--failfast`        | `true`         | Stop on first test failure                                                  |
-| `--go-version`      | auto           | Detected from `go.mod` (currently 1.26.1)                                   |
+| `--go-version`      | auto           | Detected from `go.mod` (currently 1.27.0)                                   |
 | `--clean-before`    | `true`         | Clean stale (stopped/exited) containers before starting                     |
 | `--clean-after`     | `true`         | Clean this run's containers after completion                                |
 | `--keep-on-failure` | `false`        | Preserve containers for manual inspection on failure                        |

cmd/hi/run.go

@@ -71,7 +71,7 @@ func detectGoVersion() string {
 	if err != nil {
 		content, err = os.ReadFile(filepath.Join("..", "..", "go.mod"))
 		if err != nil {
-			return "1.26.1"
+			return "1.27.0"
 		}
 	}
 
@@ -83,5 +83,5 @@ func detectGoVersion() string {
 		}
 	}
 
-	return "1.26.1"
+	return "1.27.0"
 }

docs/setup/install/source.md

@@ -43,7 +43,7 @@ cp headscale /usr/local/sbin
 
 ```shell
 # Install prerequisites
-# 1. go v1.20+: headscale newer than 0.21 needs go 1.20+ to compile
+# 1. go v1.27+: see the go directive in go.mod for the exact minimum
 # 2. gmake: Makefile in the headscale repo is written in GNU make syntax
 
 git clone https://github.com/juanfont/headscale.git